Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\_mei2762\pil\_imaging.cp37-win_amd64.pyd
- %TEMP%\_mei2762\win32ui.pyd
- %TEMP%\_mei2762\win32wnet.pyd
- %TEMP%\_mei2762\zerov.exe.manifest
- %TEMP%\_mei2762\include\pyconfig.h
- %TEMP%\_mei2762\base_library.zip
- %TEMP%\_mei2762\certifi\cacert.pem
- %TEMP%\_mei2762\license.lic
- %TEMP%\_mei2762\pytransform.key
- %TEMP%\cmtk6wl2
- %TEMP%\_mei2762\win32crypt.pyd
- %TEMP%\_mei2762\win32trace.pyd
- %TEMP%\nl-2020-02-10-03-27-47\steam\config\config.vdf
- %TEMP%\nl-2020-02-10-03-27-47\screen.jpg
- %APPDATA%\opera software\opera stable\cookies1opera
- %LOCALAPPDATA%\google\chrome\user data\default\cookies1google chrome
- %APPDATA%\opera software\opera stable\login data1torch
- %LOCALAPPDATA%\google\chrome\user data\default\login data1torch
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cookiesfirefox_cookies.sqlite
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cookiesfirefox_cookies.sqlite-shm
- %TEMP%\nl-2020-02-10-03-27-47\errors\cookies1opera
- %TEMP%\nl-2020-02-10-03-27-47\errors\cookies1google chrome
- %TEMP%\nl-2020-02-10-03-27-47\steam\config\dialogconfig.vdf
- %TEMP%\nl-2020-02-10-03-27-47\info.txt
- %TEMP%\_mei2762\win32com\shell\shell.pyd
- %TEMP%\_mei2762\win32api.pyd
- %TEMP%\_mei2762\unicodedata.pyd
- %TEMP%\_mei2762\pil\_webp.cp37-win_amd64.pyd
- %TEMP%\_mei2762\vcruntime140.dll
- %TEMP%\_mei2762\_bz2.pyd
- %TEMP%\_mei2762\_ctypes.pyd
- %TEMP%\_mei2762\_decimal.pyd
- %TEMP%\_mei2762\_hashlib.pyd
- %TEMP%\_mei2762\_lzma.pyd
- %TEMP%\_mei2762\_pytransform.dll
- %TEMP%\_mei2762\_queue.pyd
- %TEMP%\_mei2762\_socket.pyd
- %TEMP%\_mei2762\pil\_imagingtk.cp37-win_amd64.pyd
- %TEMP%\_mei2762\_sqlite3.pyd
- %TEMP%\_mei2762\_win32sysloader.pyd
- %TEMP%\_mei2762\libcrypto-1_1-x64.dll
- %TEMP%\_mei2762\libssl-1_1-x64.dll
- %TEMP%\_mei2762\mfc140u.dll
- %TEMP%\_mei2762\pyexpat.pyd
- %TEMP%\_mei2762\python37.dll
- %TEMP%\_mei2762\pythoncom37.dll
- %TEMP%\_mei2762\pywintypes37.dll
- %TEMP%\_mei2762\select.pyd
- %TEMP%\_mei2762\sqlite3.dll
- %TEMP%\_mei2762\_ssl.pyd
- %TEMP%\nl-2020-02-10-03-27-47\errors\cookiesfirefox_cookies.sqlite
- %TEMP%\nl-2020-02-10-03-27-47.zip
Deletes the following files
- %TEMP%\cmtk6wl2
- %TEMP%\_mei2762\win32api.pyd
- %TEMP%\_mei2762\win32com\shell\shell.pyd
- %TEMP%\_mei2762\win32crypt.pyd
- %TEMP%\_mei2762\win32trace.pyd
- %TEMP%\_mei2762\win32ui.pyd
- %TEMP%\_mei2762\win32wnet.pyd
- %TEMP%\_mei2762\zerov.exe.manifest
- %TEMP%\_mei2762\_ctypes.pyd
- %TEMP%\_mei2762\_ssl.pyd
- %TEMP%\_mei2762\_decimal.pyd
- %TEMP%\_mei2762\_hashlib.pyd
- %TEMP%\_mei2762\_lzma.pyd
- %TEMP%\_mei2762\_pytransform.dll
- %TEMP%\_mei2762\_queue.pyd
- %TEMP%\_mei2762\_socket.pyd
- %TEMP%\_mei2762\_sqlite3.pyd
- %TEMP%\_mei2762\vcruntime140.dll
- %TEMP%\_mei2762\_bz2.pyd
- %TEMP%\_mei2762\unicodedata.pyd
- %TEMP%\_mei2762\mfc140u.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cookiesfirefox_cookies.sqlite-shm
- %TEMP%\_mei2762\base_library.zip
- %TEMP%\_mei2762\certifi\cacert.pem
- %TEMP%\_mei2762\include\pyconfig.h
- %TEMP%\_mei2762\libcrypto-1_1-x64.dll
- %TEMP%\_mei2762\libssl-1_1-x64.dll
- %TEMP%\_mei2762\license.lic
- %TEMP%\_mei2762\pil\_imaging.cp37-win_amd64.pyd
- %TEMP%\_mei2762\select.pyd
- %TEMP%\_mei2762\pil\_imagingtk.cp37-win_amd64.pyd
- %TEMP%\_mei2762\pil\_webp.cp37-win_amd64.pyd
- %TEMP%\_mei2762\pyexpat.pyd
- %TEMP%\_mei2762\python37.dll
- %TEMP%\_mei2762\pythoncom37.dll
- %TEMP%\_mei2762\pytransform.key
- %TEMP%\_mei2762\pywintypes37.dll
- %TEMP%\_mei2762\sqlite3.dll
- %TEMP%\_mei2762\_win32sysloader.pyd
Network activity
TCP
- 'google.com':443
- 'ip##fo.io':443
- 'ap#.##legram.org':443
- 'co#####.dropboxapi.com':443
UDP
- DNS ASK google.com
- DNS ASK ip##fo.io
- DNS ASK ap#.##legram.org
- DNS ASK co#####.dropboxapi.com
